Enterprise adoption of digital tools and platforms continues to accelerate, expanding the number of vendors, services, and partners organizations depend on to maintain day-to-day operations. But while this interconnectivity fuels agility and innovation, it also introduces a growing set of risks—many of which originate outside the organization.
Third-party ecosystems have become one of the most significant and complex parts of the enterprise attack surface. According to industry data, approximately 60% of data breaches in large organizations over the past year involved a third party. Despite that, Third-Party Risk Management remains one of the more outdated and fragmented areas of cybersecurity—often reliant on static assessments, manual questionnaires, and labor-intensive follow-ups.
As companies look to scale faster, they’re increasingly constrained by TPRM programs that can’t keep up. The question many CISOs are asking is: Can organizations grow without increasing their risk exposure?
The Growing Complexity of Vendor Relationships
Enterprises today rely on hundreds, if not thousands, of third-party vendors—ranging from SaaS providers and cloud platforms to contractors and managed service providers. The scale of these relationships, combined with the speed at which they’re adopted, presents a significant challenge for teams tasked with ensuring those vendors are secure and compliant.
The issue isn’t limited to volume. Traditional TPRM processes were designed for slower, more predictable procurement cycles. They often fall short when applied to decentralized decision-making and agile vendor onboarding models. And while technology in other areas of the enterprise has evolved rapidly, TPRM tools and workflows have largely stayed the same.
Saket Modi, co-founder and CEO of SAFE, described the core problem to me as more than just a tooling gap. “Traditional TPRM is a perfect storm of fragmentation, manual labor, and misaligned incentives,” Modi said.
He argues that while digital transformation has outpaced most organizational functions, TPRM has remained “tethered to spreadsheets, one-off tools, and reactive thinking.”
TPRM Is Being Redefined
In response to these challenges, a new generation of solutions is emerging that seeks to rethink the structure of TPRM altogether. SAFE just announced its launch of what it describes as the industry’s first fully autonomous TPRM platform.
According to the company, the platform is built on a system of specialized AI agents that handle key parts of the vendor risk lifecycle—such as onboarding, assessments, and ongoing monitoring—with minimal human intervention. This agentic AI model enables the automation of previously manual workflows and provides continuous visibility into vendor risk.
SAFE claims the approach has resonated with customers, stating it has reached $10 million in annual recurring revenue from TPRM alone in less than one year, with adoption by enterprises like Instacart, Danaher, and Victoria’s Secret.
Modi distinguishes SAFE’s approach from traditional automation tools, emphasizing the difference between task execution and intelligent decision-making: “Automation executes tasks. Autonomy makes decisions,” he explained.
The platform reportedly integrates public data sources, questionnaire responses, and contract terms to evaluate third-party risk in real time, enabling security teams to scale oversight without proportional increases in headcount.
Strategic Implications for Security and the Business
Beyond operational efficiency, platforms that provide real-time, context-aware TPRM have the potential to deliver strategic benefits. Continuous risk intelligence allows executives to assess the potential impact of vendor decisions on broader business outcomes and regulatory exposure. It also supports better alignment between security teams, legal departments, and procurement functions.
When TPRM shifts from being a point-in-time check to a dynamic feedback loop, it changes how organizations think about trust, risk tolerance, and resource allocation. It also provides a stronger foundation for reporting and governance—particularly as regulatory frameworks such as the SEC’s cybersecurity disclosure rule and the EU’s DORA directive introduce stricter expectations for third-party oversight.
The Shift Toward Predictive TPRM
Looking forward, the TPRM market is expected to evolve beyond identification and into prediction. SAFE and others in the space anticipate capabilities that simulate risk scenarios, model potential attack paths, and provide proactive mitigation strategies before an incident occurs.
This next phase will likely emphasize deeper integration with enterprise systems, contract workflows, and external data feeds—enabling TPRM to be embedded at the speed of procurement rather than lagging behind it. It also suggests that security teams will need to be more data-driven, cross-functional, and equipped with tools that go beyond assessment to support decision-making.
Aligning Trust with Velocity
Organizations can’t afford for security processes to become bottlenecks. At the same time, moving too quickly without appropriate controls can introduce liabilities that are difficult to unwind.
Autonomous, AI-driven TPRM platforms point to a path forward—one that supports velocity without sacrificing visibility. Whether this approach becomes the industry standard remains to be seen, but there is growing consensus that managing third-party risk should be as agile and intelligent as the businesses it serves.
